2020-01-31 13:46:46 +00:00
|
|
|
local DOMAIN = assert(ENV_SNIKKET_DOMAIN, "Please set the SNIKKET_DOMAIN environment variable")
|
|
|
|
|
2021-01-29 22:25:33 +00:00
|
|
|
local RETENTION_DAYS = tonumber(ENV_SNIKKET_RETENTION_DAYS) or 7;
|
2021-10-14 13:35:42 +00:00
|
|
|
local UPLOAD_STORAGE_GB = tonumber(ENV_SNIKKET_UPLOAD_STORAGE_GB);
|
2021-01-29 22:25:33 +00:00
|
|
|
|
2020-11-06 16:41:55 +00:00
|
|
|
if prosody.process_type == "prosody" and not prosody.config_loaded then
|
|
|
|
-- Wait at startup for certificates
|
|
|
|
local lfs, socket = require "lfs", require "socket";
|
|
|
|
local cert_path = "/etc/prosody/certs/"..DOMAIN..".crt";
|
|
|
|
local counter = 0;
|
|
|
|
while not lfs.attributes(cert_path, "mode") do
|
|
|
|
counter = counter + 1;
|
|
|
|
if counter == 1 or counter%6 == 0 then
|
|
|
|
print("Waiting for certificates...");
|
|
|
|
elseif counter > 60 then
|
|
|
|
print("No certificates found... exiting");
|
|
|
|
os.exit(1);
|
|
|
|
end
|
|
|
|
socket.sleep(5);
|
|
|
|
end
|
|
|
|
_G.ltn12 = require "ltn12";
|
|
|
|
end
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
network_backend = "epoll"
|
|
|
|
|
|
|
|
plugin_paths = { "/etc/prosody/modules" }
|
|
|
|
|
|
|
|
data_path = "/snikket/prosody"
|
|
|
|
|
|
|
|
pidfile = "/var/run/prosody/prosody.pid"
|
|
|
|
|
2021-11-12 13:41:32 +00:00
|
|
|
admin_shell_prompt = ("prosody [%s]> "):format(DOMAIN)
|
|
|
|
|
2021-11-11 14:40:09 +00:00
|
|
|
-- Aggressive GC to reduce resource consumption. These values are not
|
|
|
|
-- incredibly scientific, but should be good for a small private server.
|
|
|
|
-- They should be reviewed on the upgrade to Lua 5.4.
|
|
|
|
gc = { threshold = 100, speed = 750 }
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
modules_enabled = {
|
|
|
|
|
|
|
|
-- Generally required
|
|
|
|
"roster"; -- Allow users to have a roster. Recommended ;)
|
|
|
|
"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
|
|
|
|
"tls"; -- Add support for secure TLS on c2s/s2s connections
|
|
|
|
"disco"; -- Service discovery
|
|
|
|
|
|
|
|
-- Not essential, but recommended
|
|
|
|
"carbons"; -- Keep multiple clients in sync
|
|
|
|
"pep"; -- Enables users to publish their avatar, mood, activity, playing music and more
|
|
|
|
"blocklist"; -- Allow users to block communications with other users
|
|
|
|
"vcard4"; -- User profiles (stored in PEP)
|
|
|
|
"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
|
|
|
|
|
|
|
|
-- Nice to have
|
|
|
|
"version"; -- Replies to server version requests
|
|
|
|
"uptime"; -- Report how long server has been running
|
|
|
|
"time"; -- Let others know the time here on this server
|
|
|
|
"ping"; -- Replies to XMPP pings with pongs
|
|
|
|
"register"; -- Allow users to register on this server using a client and change passwords
|
|
|
|
"mam"; -- Store messages in an archive and allow users to access it
|
|
|
|
"csi_simple"; -- Simple Mobile optimizations
|
2021-01-22 12:47:24 +00:00
|
|
|
|
|
|
|
-- Push notifications
|
|
|
|
"cloud_notify";
|
2021-10-16 20:22:50 +00:00
|
|
|
"cloud_notify_extensions";
|
2020-01-31 13:46:46 +00:00
|
|
|
|
|
|
|
-- HTTP modules
|
|
|
|
"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
|
|
|
|
"websocket"; -- XMPP over WebSockets
|
2021-03-10 14:37:19 +00:00
|
|
|
"http_host_status_check"; -- Health checks over HTTP
|
2020-01-31 13:46:46 +00:00
|
|
|
|
|
|
|
-- Other specific functionality
|
|
|
|
"limits"; -- Enable bandwidth limiting for XMPP connections
|
|
|
|
"watchregistrations"; -- Alert admins of registrations
|
|
|
|
"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
|
|
|
|
"smacks";
|
|
|
|
"email";
|
|
|
|
"http_altconnect";
|
|
|
|
"bookmarks";
|
|
|
|
"default_bookmarks";
|
|
|
|
"update_check";
|
2020-11-11 16:50:30 +00:00
|
|
|
"update_notify";
|
2020-04-29 21:39:27 +00:00
|
|
|
"turncredentials";
|
2020-06-22 10:44:30 +00:00
|
|
|
"admin_shell";
|
2021-11-08 12:51:14 +00:00
|
|
|
"isolate_host";
|
2021-10-18 12:50:36 +00:00
|
|
|
"snikket_client_id";
|
2021-10-18 13:15:56 +00:00
|
|
|
"snikket_ios_preserve_push";
|
2021-11-12 15:56:52 +00:00
|
|
|
"snikket_restricted_users";
|
2021-11-17 13:47:42 +00:00
|
|
|
"lastlog2";
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-08-26 18:42:26 +00:00
|
|
|
-- Spam/abuse management
|
|
|
|
"spam_reporting"; -- Allow users to report spam/abuse
|
|
|
|
"watch_spam_reports"; -- Alert admins of spam/abuse reports by users
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
-- TODO...
|
|
|
|
--"groups"; -- Shared roster support
|
|
|
|
--"server_contact_info"; -- Publish contact information for this service
|
|
|
|
--"announce"; -- Send announcement to all online users
|
|
|
|
--"motd"; -- Send a message to users when they log in
|
|
|
|
"welcome"; -- Welcome users who register accounts
|
|
|
|
"http_files"; -- Serve static files from a directory over HTTP
|
|
|
|
"reload_modules";
|
2021-01-27 13:11:36 +00:00
|
|
|
|
|
|
|
-- Invites
|
|
|
|
"invites";
|
|
|
|
"invites_adhoc";
|
|
|
|
"invites_api";
|
|
|
|
"invites_groups";
|
2020-01-31 13:46:46 +00:00
|
|
|
"invites_page";
|
|
|
|
"invites_register";
|
2021-01-27 13:11:36 +00:00
|
|
|
"invites_register_api";
|
|
|
|
"invites_tracking";
|
2021-01-28 21:28:40 +00:00
|
|
|
"invites_default_group";
|
2021-03-10 10:32:06 +00:00
|
|
|
"invites_bootstrap";
|
2021-01-27 13:11:36 +00:00
|
|
|
|
2020-01-31 19:57:54 +00:00
|
|
|
"firewall";
|
2021-01-22 12:39:07 +00:00
|
|
|
|
2021-01-27 13:11:36 +00:00
|
|
|
-- Circles
|
2021-02-04 15:57:14 +00:00
|
|
|
"groups_internal";
|
2021-01-27 13:11:36 +00:00
|
|
|
"groups_migration";
|
2021-02-04 15:55:11 +00:00
|
|
|
"groups_muc_bookmarks";
|
2021-01-27 13:11:36 +00:00
|
|
|
|
2021-01-22 12:39:07 +00:00
|
|
|
-- For the web portal
|
|
|
|
"http_oauth2";
|
|
|
|
"http_admin_api";
|
|
|
|
"rest";
|
2021-05-27 16:03:48 +00:00
|
|
|
|
|
|
|
-- Monitoring & maintenance
|
|
|
|
"measure_process";
|
2021-11-17 13:51:05 +00:00
|
|
|
"measure_active_users";
|
2020-01-31 13:46:46 +00:00
|
|
|
}
|
|
|
|
|
2020-01-31 19:53:52 +00:00
|
|
|
registration_watchers = {} -- Disable by default
|
|
|
|
registration_notification = "New user registered: $username"
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
reload_global_modules = { "http" }
|
|
|
|
|
2020-12-11 16:51:34 +00:00
|
|
|
http_ports = { ENV_SNIKKET_TWEAK_INTERNAL_HTTP_PORT or 5280 }
|
2021-02-17 13:28:30 +00:00
|
|
|
http_interfaces = { ENV_SNIKKET_TWEAK_INTERNAL_HTTP_INTERFACE or "127.0.0.1" }
|
2020-12-11 16:51:34 +00:00
|
|
|
|
|
|
|
https_ports = {};
|
2020-05-12 14:05:42 +00:00
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
legacy_ssl_ports = { 5223 }
|
|
|
|
|
|
|
|
allow_registration = true
|
|
|
|
registration_invite_only = true
|
|
|
|
|
2021-01-28 09:01:08 +00:00
|
|
|
-- This disables in-app invites for non-admins
|
|
|
|
-- TODO: The plan is to enable it once we can
|
|
|
|
-- give the admin more fine-grained control
|
|
|
|
-- over what happens when a user invites someone.
|
|
|
|
allow_contact_invites = false
|
|
|
|
|
2021-11-09 12:01:59 +00:00
|
|
|
-- Disallow restricted users to create invitations to the server
|
|
|
|
deny_user_invites_by_roles = { "prosody:restricted" }
|
|
|
|
|
2021-02-03 18:01:48 +00:00
|
|
|
invites_page = ENV_SNIKKET_INVITE_URL or ("https://"..DOMAIN.."/invite/{invite.token}/");
|
2021-01-27 17:33:13 +00:00
|
|
|
invites_page_external = true
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-03-10 12:12:15 +00:00
|
|
|
invites_bootstrap_index = tonumber(ENV_TWEAK_SNIKKET_BOOTSTRAP_INDEX)
|
2021-03-09 16:33:12 +00:00
|
|
|
invites_bootstrap_secret = ENV_TWEAK_SNIKKET_BOOTSTRAP_SECRET
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
c2s_require_encryption = true
|
|
|
|
s2s_require_encryption = true
|
|
|
|
s2s_secure_auth = true
|
|
|
|
|
2021-01-29 22:25:33 +00:00
|
|
|
archive_expires_after = ("%dd"):format(RETENTION_DAYS) -- Remove archived messages after N days
|
2020-01-31 13:46:46 +00:00
|
|
|
|
|
|
|
-- Disable IPv6 by default because Docker does not
|
|
|
|
-- have it enabled by default, and s2s to domains
|
|
|
|
-- with A+AAAA records breaks (as opposed to just AAAA)
|
|
|
|
-- TODO: implement happy eyeballs in net.connect
|
|
|
|
-- https://issues.prosody.im/1246
|
|
|
|
use_ipv6 = (ENV_SNIKKET_TWEAK_IPV6 == "1")
|
|
|
|
|
|
|
|
log = {
|
|
|
|
[ENV_SNIKKET_LOGLEVEL or "info"] = "*stdout"
|
|
|
|
}
|
|
|
|
|
|
|
|
authentication = "internal_hashed"
|
|
|
|
authorization = "internal"
|
|
|
|
storage = "internal"
|
|
|
|
statistics = "internal"
|
2021-05-27 16:04:35 +00:00
|
|
|
|
|
|
|
if ENV_SNIKKET_TWEAK_PROMETHEUS == "1" then
|
|
|
|
-- When using Prometheus, it is desirable to let the prometheus scraping
|
|
|
|
-- drive the sampling of metrics
|
|
|
|
statistics_interval = "manual"
|
|
|
|
else
|
|
|
|
-- When not using Prometheus, we need an interval so that the metrics can
|
|
|
|
-- be shown by the web portal. The HTTP admin API exposure does not force
|
|
|
|
-- a collection as it is only interested in very few specific metrics.
|
|
|
|
statistics_interval = 60
|
|
|
|
end
|
2020-01-31 13:46:46 +00:00
|
|
|
|
|
|
|
certificates = "certs"
|
|
|
|
|
2021-02-02 10:48:31 +00:00
|
|
|
group_default_name = ENV_SNIKKET_SITE_NAME or DOMAIN
|
|
|
|
|
2020-11-11 16:50:30 +00:00
|
|
|
-- Update check configuration
|
|
|
|
software_name = "Snikket"
|
|
|
|
update_notify_version_url = "https://snikket.org/updates/{branch}/{version}"
|
|
|
|
update_notify_support_url = "https://snikket.org/notices/{branch}/"
|
|
|
|
update_notify_message_url = "https://snikket.org/notices/{branch}/{message}"
|
2021-02-02 13:58:02 +00:00
|
|
|
|
|
|
|
if ENV_SNIKKET_UPDATE_CHECK ~= "0" then
|
|
|
|
update_check_dns = "_{branch}.update.snikket.net"
|
|
|
|
update_check_interval = 21613 -- ~6h
|
|
|
|
end
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-01-22 23:01:52 +00:00
|
|
|
http_default_host = DOMAIN
|
2020-01-31 13:46:46 +00:00
|
|
|
http_host = DOMAIN
|
2021-01-22 23:01:52 +00:00
|
|
|
http_external_url = "https://"..DOMAIN.."/"
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-03-17 15:16:27 +00:00
|
|
|
if ENV_SNIKKET_TWEAK_TURNSERVER ~= "0" or ENV_SNIKKET_TWEAK_TURNSERVER_DOMAIN then
|
|
|
|
turncredentials_host = ENV_SNIKKET_TWEAK_TURNSERVER_DOMAIN or DOMAIN
|
|
|
|
turncredentials_secret = ENV_SNIKKET_TWEAK_TURNSERVER_SECRET or assert(io.open("/snikket/prosody/turn-auth-secret-v2")):read("*l");
|
2021-02-24 14:36:06 +00:00
|
|
|
end
|
2020-04-29 21:39:27 +00:00
|
|
|
|
2021-11-08 12:51:14 +00:00
|
|
|
-- Allow restricted users access to push notification servers
|
|
|
|
isolate_except_domains = { "push.snikket.net", "push-ios.snikket.net" }
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
VirtualHost (DOMAIN)
|
|
|
|
authentication = "internal_hashed"
|
|
|
|
|
|
|
|
http_files_dir = "/var/www"
|
|
|
|
http_paths = {
|
|
|
|
files = "/";
|
|
|
|
landing_page = "/";
|
|
|
|
invites_page = "/invite";
|
|
|
|
invites_register = "/register";
|
|
|
|
}
|
|
|
|
|
2021-05-27 16:04:35 +00:00
|
|
|
if ENV_SNIKKET_TWEAK_PROMETHEUS == "1" then
|
|
|
|
modules_enabled = {
|
|
|
|
"prometheus";
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2021-01-28 22:37:50 +00:00
|
|
|
welcome_message = [[Hi, welcome to Snikket on $host! Thanks for joining us.]]
|
|
|
|
.."\n\n"
|
|
|
|
..[[For help and enquiries related to this service you may contact the admin via email: ]]
|
|
|
|
..ENV_SNIKKET_ADMIN_EMAIL
|
|
|
|
.."\n\n"
|
|
|
|
..[[Happy chatting!]]
|
2020-01-31 13:46:46 +00:00
|
|
|
|
|
|
|
Component ("groups."..DOMAIN) "muc"
|
|
|
|
modules_enabled = {
|
|
|
|
"muc_mam";
|
2020-05-13 11:20:25 +00:00
|
|
|
"muc_local_only";
|
2020-01-31 13:46:46 +00:00
|
|
|
"vcard_muc";
|
|
|
|
"muc_defaults";
|
2021-10-16 20:22:28 +00:00
|
|
|
"muc_offline_delivery";
|
2021-11-09 11:23:19 +00:00
|
|
|
"snikket_restricted_users";
|
2021-11-16 16:08:16 +00:00
|
|
|
"muc_auto_reserve_nicks";
|
2020-01-31 13:46:46 +00:00
|
|
|
}
|
|
|
|
restrict_room_creation = "local"
|
2020-05-13 13:26:58 +00:00
|
|
|
muc_local_only = { "general@groups."..DOMAIN }
|
2021-11-08 16:13:07 +00:00
|
|
|
|
|
|
|
-- Default configuration for rooms (typically overwritten by the client)
|
2020-01-31 13:46:46 +00:00
|
|
|
muc_room_default_allow_member_invites = true
|
2021-11-08 16:13:07 +00:00
|
|
|
muc_room_default_persistent = true
|
|
|
|
muc_room_default_public = false
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-11-16 16:08:16 +00:00
|
|
|
-- Enable push notifications for offline group members by default
|
|
|
|
-- (this also requires mod_muc_auto_reserve_nicks in practice)
|
|
|
|
muc_offline_delivery_default = true
|
|
|
|
|
2020-01-31 13:46:46 +00:00
|
|
|
default_mucs = {
|
|
|
|
{
|
|
|
|
jid_node = "general";
|
|
|
|
config = {
|
|
|
|
name = "General Chat";
|
|
|
|
description = "Welcome to "..DOMAIN.." general chat!";
|
|
|
|
change_subject = false;
|
|
|
|
history_length = 30;
|
|
|
|
members_only = false;
|
|
|
|
moderated = false;
|
|
|
|
persistent = true;
|
|
|
|
public = true;
|
|
|
|
public_jids = true;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-02-24 18:21:31 +00:00
|
|
|
Component ("share."..DOMAIN) "http_file_share"
|
2021-01-22 23:02:29 +00:00
|
|
|
-- For backwards compat, allow HTTP upload on the base domain
|
|
|
|
if ENV_SNIKKET_TWEAK_SHARE_DOMAIN ~= "1" then
|
|
|
|
http_host = "share."..DOMAIN
|
2021-01-29 22:17:32 +00:00
|
|
|
http_external_url = "https://share."..DOMAIN.."/"
|
2021-01-22 23:02:29 +00:00
|
|
|
end
|
2021-11-09 14:25:56 +00:00
|
|
|
|
|
|
|
-- 128 bits (i.e. 16 bytes) is the maximum length of a GCM auth tag, which
|
|
|
|
-- is appended to encrypted uploads according to XEP-0454. This ensures we
|
|
|
|
-- allow files up to the size limit even if they are encrypted.
|
|
|
|
http_file_share_size_limit = (1024 * 1024 * 100) + 16 -- 100MB + 16 bytes
|
2021-02-24 18:21:31 +00:00
|
|
|
http_file_share_expire_after = 60 * 60 * 24 * RETENTION_DAYS -- N days
|
2021-11-09 14:25:56 +00:00
|
|
|
|
2021-10-14 13:35:42 +00:00
|
|
|
if UPLOAD_STORAGE_GB then
|
|
|
|
http_file_share_global_quota = 1024 * 1024 * 1024 * UPLOAD_STORAGE_GB
|
2021-10-14 13:16:04 +00:00
|
|
|
end
|
2021-02-24 18:21:31 +00:00
|
|
|
http_paths = {
|
|
|
|
file_share = "/upload"
|
|
|
|
}
|
2020-01-31 13:46:46 +00:00
|
|
|
|
2021-03-17 15:22:30 +00:00
|
|
|
Include (ENV_SNIKKET_TWEAK_EXTRA_CONFIG or "/snikket/prosody/*.cfg.lua")
|